Dahua Firmware Mod Kit + Modded Dahua Firmware

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
Get a serial uart adapter, everything else is just guesswork. I can't really do much without having a camera at hand myself
Maybe this will give you more info what is wrong ? :)
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
Put printenv in the commands.txt
Run commands.bat
Paste the output of that.
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
I'm using windows and do not have printenv on it. Is there any way you can help me with this ?
Dude what??
In commands.txt write printenv + Enter
Then run commands.bat
Then plug your camera in with the TFTPServer and Console.bat thing running.
The camera will run the printenv command...
 

cctvguynz

n3wb
Joined
Dec 17, 2016
Messages
26
Reaction score
2
Can anybody confirm for me what firmware variant the HDBW4421R is? Does anybody have a version for this camera?
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
Sorry was too late, below you can find results of printenv:

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParametersV2.txt
fail to load bootargsParametersV2.txt
fail to init bootargsParametersV2
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x84000000
Downloading: *
done
Bytes transferred = 72 (48 hex)
bootcmd=kload 0x82000000; bootm 0x82000000bootdelay=1baudrate=115200ipaddr=192.168.1.108serverip=192.168.1.1gatewayip=192.168.1.1netmask=255.255.255.0bootfile="uImage"wifiaddr=00:12:34:56:78:91dh_keyboard=1sysbackup=1loglevel=4 pd=tftp 0x82000000 pd-x.squashfs.img; flwriteethact=gmacBSN=3F03BE5PAA00298bootargs=mem=93M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfsHWID=IPC-HDBW4231R-Z:01:02:05:36:1A:17:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100devalias=IPC-HDBW5231R-ZID=3G071FCPAA00016ethaddr=E0:50:8B:EE:BA:48da=tftp 0x82000000 dhboot.bin.img;flwrite;tftp 0x82000000 dhboot-min.bin.img;nand protect off;flwrite;dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite;dk=tftp 0x82000000 kernel.img;flwrite;du=tftp 0x82000000 user-x.squashfs.img; flwritedw=tftp 0x82000000 web-x.squashfs.img; flwritedp=tftp 0x82000000 partition-x.cramfs.img;flwrite;dc=tftp 0x82000000 custom-x.squashfs.img; flwriteup=tftp 0x82000000 update.img;flwrite;tk=tftp 0x82000000 uImage;bootm;appauto=1stdin=serialstdout=serialstderr=serialverify=nver=U-Boot 2010.06-svn3638 (Dec 09 2016 - 15:45:17)filesize=48fileaddr=84000000
Environment size: 1154/131068 bytes
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=93M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
 

cctvguynz

n3wb
Joined
Dec 17, 2016
Messages
26
Reaction score
2
Can anybody confirm for me what firmware variant the HDBW4421R is? Does anybody have a version for this camera?
Oops just realised I didn't look properly on the front page and obviously didn't click to expand everything. I was thinking it was a 1st gen and not a 2nd gen.
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
Sorry was too late, below you can find results of printenv:

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParametersV2.txt
fail to load bootargsParametersV2.txt
fail to init bootargsParametersV2
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x84000000
Downloading: *
done
Bytes transferred = 72 (48 hex)
bootcmd=kload 0x82000000; bootm 0x82000000bootdelay=1baudrate=115200ipaddr=192.168.1.108serverip=192.168.1.1gatewayip=192.168.1.1netmask=255.255.255.0bootfile="uImage"wifiaddr=00:12:34:56:78:91dh_keyboard=1sysbackup=1loglevel=4 pd=tftp 0x82000000 pd-x.squashfs.img; flwriteethact=gmacBSN=3F03BE5PAA00298bootargs=mem=93M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfsHWID=IPC-HDBW4231R-Z:01:02:05:36:1A:17:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100devalias=IPC-HDBW5231R-ZID=3G071FCPAA00016ethaddr=E0:50:8B:EE:BA:48da=tftp 0x82000000 dhboot.bin.img;flwrite;tftp 0x82000000 dhboot-min.bin.img;nand protect off;flwrite;dr=tftp 0x82000000 romfs-x.squashfs.img; flwrite;dk=tftp 0x82000000 kernel.img;flwrite;du=tftp 0x82000000 user-x.squashfs.img; flwritedw=tftp 0x82000000 web-x.squashfs.img; flwritedp=tftp 0x82000000 partition-x.cramfs.img;flwrite;dc=tftp 0x82000000 custom-x.squashfs.img; flwriteup=tftp 0x82000000 update.img;flwrite;tk=tftp 0x82000000 uImage;bootm;appauto=1stdin=serialstdout=serialstderr=serialverify=nver=U-Boot 2010.06-svn3638 (Dec 09 2016 - 15:45:17)filesize=48fileaddr=84000000
Environment size: 1154/131068 bytes
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=93M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
So eh wtf.
Your cameras HWID is IPC-HDBW4231R-Z:01:02:05:36:1A:17:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100
but the device alias is IPC-HDBW5231R-Z ???
Anyways for that HWID the IPC-HX4XXX-NAND-Eos firmware is the correct one.
So try this one instead, should work™ https://i.botox.bz/General_IPC-HX4XXX-NAND-Eos_EngChnFraSpaRus_PN_Stream3_V2.420.0000.21.R.20160724.zip
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
So eh wtf.
Your cameras HWID is IPC-HDBW4231R-Z:01:02:05:36:1A:17:01:00:00:00:04:258:00:00:00:00:00:01:00:00:100
but the device alias is IPC-HDBW5231R-Z ???
Anyways for that HWID the IPC-HX4XXX-NAND-Eos firmware is the correct one.
So try this one instead, should work™ https://i.botox.bz/General_IPC-HX4XXX-NAND-Eos_EngChnFraSpaRus_PN_Stream3_V2.420.0000.21.R.20160724.zip
This is even more strange because all cameras were purchased as the model IPC-HDBW5231R-Z. Never the less I try to use last firmware given by you and it was flashed but no changes

Result of TFTP:

accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001

starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 0.0.0.0:69
Client 192.168.1.108:3792 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:3874 root\romfs-x.squashfs.img, 620 Blocks Served
Client 192.168.1.108:1047 root\kernel.img, 1581 Blocks Served
Client 192.168.1.108:1048 root\user-x.squashfs.img, 15508 Blocks Served
Client 192.168.1.108:1048 root\web-x.squashfs.img, 3974 Blocks Served
Client 192.168.1.108:1048 root\partition-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:1048 root\custom-x.squashfs.img, 81 Blocks Served
Client 192.168.1.108:1046 root\pd-x.squashfs.img, 34 Blocks Served
Client 192.168.1.108:1047 root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served

And resooult of console:

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParametersV2.txt
fail to load bootargsParametersV2.txt
fail to init bootargsParametersV2
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x84000000
Downloading: *
done
Bytes transferred = 202 (ca hex)
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 909376 (de040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: romfs
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 909312 Bytes = 888 KiB
Load Address: 01200000
Entry Point: 01a00000
Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 2319632 (236510 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: kernel
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 2319568 Bytes = 2.2 MiB
Load Address: 00d00000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x00d00000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 22765632 (15b6040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: user
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 22765568 Bytes = 21.7 MiB
Load Address: 02200000
Entry Point: 03b80000
Verifying Checksum ... OK
Programing start at: 0x02200000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 5832768 (590040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: web
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 5832704 Bytes = 5.6 MiB
Load Address: 01a00000
Entry Point: 02200000
Verifying Checksum ... OK
Programing start at: 0x01a00000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: partition
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: 00500000
Entry Point: 00600000
Verifying Checksum ... OK
Programing start at: 0x00500000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 118848 (1d040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: custom
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 118784 Bytes = 116 KiB
Load Address: 00600000
Entry Point: 00980000
Verifying Checksum ... OK
Programing start at: 0x00600000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 49216 (c040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: pd
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 49152 Bytes = 48 KiB
Load Address: 00980000
Entry Point: 00d00000
Verifying Checksum ... OK
Programing start at: 0x00980000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x82000000
Downloading: *
done
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=93M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48

The still camera is showing that this is a model: IPC-HDBW5231R-Z, any clue what is going on ?
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
This is even more strange because all cameras were purchased as the model IPC-HDBW5231R-Z. Never the less I try to use last firmware given by you and it was flashed but no changes

Result of TFTP:

accepting requests..
Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001

starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 0.0.0.0:69
Client 192.168.1.108:3792 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:3874 root\romfs-x.squashfs.img, 620 Blocks Served
Client 192.168.1.108:1047 root\kernel.img, 1581 Blocks Served
Client 192.168.1.108:1048 root\user-x.squashfs.img, 15508 Blocks Served
Client 192.168.1.108:1048 root\web-x.squashfs.img, 3974 Blocks Served
Client 192.168.1.108:1048 root\partition-x.cramfs.img, 3 Blocks Served
Client 192.168.1.108:1048 root\custom-x.squashfs.img, 81 Blocks Served
Client 192.168.1.108:1046 root\pd-x.squashfs.img, 34 Blocks Served
Client 192.168.1.108:1047 root\.FLASHING_DONE_STOP_TFTP_NOW, 1 Blocks Served

And resooult of console:

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:80b80008.
NAND: Check nand flash controller v610. found
Special NAND id table Version 1.36
Nand ID: 0x98 0xF1 0x80 0x15 0xF2 0x16 0x08 0x00
NAND_ECC_NONE selected by board driver. This is not recommended !!
128 MiB
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParametersV2.txt
fail to load bootargsParametersV2.txt
fail to init bootargsParametersV2
In: serial
Out: serial
Err: serial
TEXT_BASE:81000000
Net: PHY found at 3
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x84000000
Downloading: *
done
Bytes transferred = 202 (ca hex)
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'romfs-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 909376 (de040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: romfs
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 909312 Bytes = 888 KiB
Load Address: 01200000
Entry Point: 01a00000
Verifying Checksum ... OK
Programing start at: 0x01200000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'kernel.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 2319632 (236510 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: kernel
Image Type: ARM Linux Firmware (uncompressed)
Data Size: 2319568 Bytes = 2.2 MiB
Load Address: 00d00000
Entry Point: 01200000
Verifying Checksum ... OK
Programing start at: 0x00d00000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'user-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 22765632 (15b6040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: user
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 22765568 Bytes = 21.7 MiB
Load Address: 02200000
Entry Point: 03b80000
Verifying Checksum ... OK
Programing start at: 0x02200000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'web-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 5832768 (590040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: web
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 5832704 Bytes = 5.6 MiB
Load Address: 01a00000
Entry Point: 02200000
Verifying Checksum ... OK
Programing start at: 0x01a00000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'partition-x.cramfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 4160 (1040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: partition
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 4096 Bytes = 4 KiB
Load Address: 00500000
Entry Point: 00600000
Verifying Checksum ... OK
Programing start at: 0x00500000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'custom-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 118848 (1d040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: custom
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 118784 Bytes = 116 KiB
Load Address: 00600000
Entry Point: 00980000
Verifying Checksum ... OK
Programing start at: 0x00600000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'pd-x.squashfs.img'.Download to address: 0x82000000
Downloading: *
done
Bytes transferred = 49216 (c040 hex)
Erasing update flag partition.

## Checking Image at 82000000 ...
Legacy image found
Image Name: pd
Image Type: ARM Linux Standalone Program (gzip compressed)
Data Size: 49152 Bytes = 48 KiB
Load Address: 00980000
Entry Point: 00d00000
Verifying Checksum ... OK
Programing start at: 0x00980000
write : 100%
done
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48
Using gmac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename '.FLASHING_DONE_STOP_TFTP_NOW'.Download to address: 0x82000000
Downloading: *
done
partition file version 2
rootfstype squashfs root /dev/mtdblock7
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
get bootargs info failed
cmdLine mem=93M console=ttyS0,115200 root=/dev/mtdblock7 rootfstype=squashfs
ETH0: PHY(phyaddr=-1, rmii) link UP: DUPLEX=FULL : SPEED=100M
MAC: E0-50-8B-EE-BA-48

The still camera is showing that this is a model: IPC-HDBW5231R-Z, any clue what is going on ?
"Never the less I try to use last firmware given by you and it was flashed but no changes" - What does that even mean?
The flashing was successful. Does the camera work? What changes are you expecting?
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
.
"Never the less I try to use last firmware given by you and it was flashed but no changes" - What does that even mean?
The flashing was successful. Does the camera work? What changes are you expecting?
Flashing was done with the success, camera is still working but still in system it shows as IPC-HDBW5231R-Z not IPC-HDBW4231R-Z

 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
.

Flashing was done with the success, camera is still working but still in system it shows as IPC-HDBW5231R-Z not IPC-HDBW4231R-Z

Yes, that is correct. The stuff in printenv does not change when you flash a new firmware.
You can change it yourself if you want to, however it can break stuff and I'm not even sure if this is wanted or a mistake. What does the label on the camera say?
HWID and device name are different things too, but I haven't seen them differ this much before...
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
Yes, that is correct. The stuff in printenv does not change when you flash a new firmware.
You can change it yourself if you want to, however it can break stuff and I'm not even sure if this is wanted or a mistake. What does the label on the camera say?
HWID and device name are different things too, but I haven't seen them differ this much before...
All labels on camera are showing that this is model IPC-HDBW5231R-Z, also it was purchased as model IPC-HDBW5231R-Z.

Now I do not know what to think about whether someone has sold me a model IPC-HDBW4231R-Z as model IPC-HDBW5231R-Z, or there is any other explanation.
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
All labels on camera are showing that this is model IPC-HDBW5231R-Z, also it was purchased as model IPC-HDBW5231R-Z.

Now I do not know what to think about whether someone has sold me a model IPC-HDBW4231R-Z as model IPC-HDBW5231R-Z, or there is any other explanation.
Well according to IPC-HDBW5231R-Z | Dahua Technology - Dahua Technology the IPC-HDBW5231R-Z uses IPC-HX5X3X-Rhea firmware.
But your camera uses IPC-HX4XXX-NAND-Eos firmware for IPC-HDBW4231R-ZS.
Where did you buy this camera? I'm no expert but it does seem off
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
Well according to IPC-HDBW5231R-Z | Dahua Technology - Dahua Technology the IPC-HDBW5231R-Z uses IPC-HX5X3X-Rhea firmware.
But your camera uses IPC-HX4XXX-NAND-Eos firmware for IPC-HDBW4231R-ZS.
Where did you buy this camera? I'm no expert but it does seem off
All cameras were purchased on aliexpress, I have purchased 8 of them.
This mismatch in model version can be also explanation why zooming is not working from my recorder, I'm not using dahua recorder. I can zoom in and zoom out only from camera web page.

This is link to aliexpress auction

Dahua IPC HDBW5231R Z IP Camera H2.65 H2.64 2.8mm ~12mm varifocal motorized lens 2MP IR50M built in SD card slot POE Webcam-in Surveillance Cameras from Security & Protection on Aliexpress.com | Alibaba Group
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
All cameras were purchased on aliexpress, I have purchased 8 of them.
This mismatch in model version can be also explanation why zooming is not working from my recorder, I'm not using dahua recorder. I can zoom in and zoom out only from camera web page.

This is link to aliexpress auction

Dahua IPC HDBW5231R Z IP Camera H2.65 H2.64 2.8mm ~12mm varifocal motorized lens 2MP IR50M built in SD card slot POE Webcam-in Surveillance Cameras from Security & Protection on Aliexpress.com | Alibaba Group
I believe this firmware should have working telnet, can you try: Dahua Enable Telnet
And then run cat /proc/cpuinfo
Then I guess I'd need someone to do cat /proc/cpuinfo on their *real* IPC-HDBW5231R-Z or any other Rhea camera actually.
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
I believe this firmware should have working telnet, can you try: Dahua Enable Telnet
And then run cat /proc/cpuinfo
Then I guess I'd need someone to do cat /proc/cpuinfo on their *real* IPC-HDBW5231R-Z or any other Rhea camera actually.
You were right telnet is working, result of the cat /proc/cpuinfo:

~ # cat /proc/cpuinfo
Processor : ARMv7 Processor rev 5 (v7l)
BogoMIPS : 1196.85
Features : swp half fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x0
CPU part : 0xc07
CPU revision : 5

Hardware : hi3516a
Revision : 0000
Serial : 0000000000000000
~ #
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
I believe this firmware should have working telnet, can you try: Dahua Enable Telnet
And then run cat /proc/cpuinfo
Then I guess I'd need someone to do cat /proc/cpuinfo on their *real* IPC-HDBW5231R-Z or any other Rhea camera actually.
I do have camera IPC-HDBW5231E-Z which looks to be a similar model to IPC-HDBW5231R-Z but with stronger IR. If you can modify this firmware to enable telnet I can check cat /proc/cpuinfo on it.

Firmware link:
http://www1.dahuasecurity.com/down.php?file=download/firmware/encryption/20170330/DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.460.0000.7.R.20170306.zip
 

cor35vet

IPCT Contributor
Joined
Jun 23, 2016
Messages
337
Reaction score
246
I do have camera IPC-HDBW5231E-Z which looks to be a similar model to IPC-HDBW5231R-Z but with stronger IR. If you can modify this firmware to enable telnet I can check cat /proc/cpuinfo on it.

Firmware link:
http://www1.dahuasecurity.com/down.php?file=download/firmware/encryption/20170330/DH_IPC-HX5X3X-Rhea_Eng_P_Stream3_V2.460.0000.7.R.20170306.zip
use this:
 

dartec

n3wb
Joined
Sep 18, 2017
Messages
16
Reaction score
0
With this firmware, TFTP stops with this message:

Open TFTP Server MultiThreaded Version 1.64 Windows Built 2001

starting TFTP...
alias / is mapped to root\
permitted clients: all
server port range: all
max blksize: 65464
default blksize: 512
default timeout: 60
file read allowed: Yes
file create allowed: No
file overwrite allowed: No
thread pool size: 1
Listening On: 192.168.254.254:69
Client 192.168.1.108:1615 root\upgrade_info_7db780a713a4.txt, 1 Blocks Served
Client 192.168.1.108:1774 root\romfs-x.squashfs.img, 896 Blocks Served
Client 192.168.1.108:2315 root\kernel.img, 1044 Blocks Served
Client 192.168.1.108:3378 root\user-x.squashfs.img, 10260 Blocks Served
Client 192.168.1.108:4087 root\web-x.squashfs.img, 4337 Blocks Served
Client 192.168.1.108:1785 root\partition-x.cramfs.img, 6 Blocks Served
Client 192.168.1.108:2161 root\custom-x.squashfs.img, 26 Blocks Served
Client 192.168.1.108:2574 root\pd-x.squashfs.img, Timeout

Result of the printenv:

Ncat: Version 7.40 ( Ncat - Netcat for the 21st Century )
Ncat: Listening on 192.168.254.254:5002
gBootLogPtr:00b80008.
spinor flash ID is 0x1940ef
partition file version 2
rootfstype squashfs root /dev/mtdblock5
gParameter[0]:node=bootargs, parameter=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc.
TEXT_BASE:01000000
Net: Detected MACID:3c:ef:8c:c6:48:17
PHY:0x03625cc6,addr:0x01
switch mv88e6020, phy BCM54811 init
MMC: sdmmc init
Using ambarella mac device
TFTP from server 192.168.254.254; our IP address is 192.168.1.108; sending through gateway 192.168.1.1Download Filename 'upgrade_info_7db780a713a4.txt'.Download to address: 0x5000000
Downloading: *
done
Bytes transferred = 72 (48 hex)
bootdelay=3baudrate=115200ipaddr=192.168.1.108serverip=192.168.1.1autoload=yesgatewayip=192.168.1.1netmask=255.255.255.0dh_keyboard=1sysbackup=1logserver=127.0.0.1loglevel=4 autosip=192.168.254.254autolip=192.168.1.108autogw=192.168.1.1autonm=255.255.255.0pd=tftp 0x02000000 pd-x.squashfs.img; flwriteethact=ambarella macBSN=2G05AB9PAQ00162HWID=IPC-HDBW5231EP-Z-S2:01:02:05:4A:21:00:01:0F:01:01:04:2D0:03:00:00:04:00:01:00:00:100hwidEx=00:02:00:00:00:00:00:00:00:00:00:00:00:00:00:00devalias=IPC-HDBW5231E-Zda=tftp 0x2000000 dhboot.bin.img; flwrite; tftp dhboot-min.bin.img;flwritedr=tftp 0x2000000 romfs-x.squashfs.img; flwritedk=tftp 0x2000000 kernel.img; flwritedu=tftp 0x2000000 user-x.squashfs.img; flwritedw=tftp 0x2000000 web-x.squashfs.img; flwritedc=tftp 0x2000000 custom-x.squashfs.img; flwritedt=tftp 0x2000000 data-x.squashfs.img; flwritedp=tftp 0x02000000 partition-x.cramfs.img;flwriteup=tftp 0x2000000 update.img; flwritetk=tftp 0x200100 hawthorn.dts.dtb;tftp 0x2000000 uImage;bootm 0x2000000bootcmd=sf read 0x200100 0x8000 0x8000;sf read 0x2000000 0xf0000 0x180000;bootm 0x2000000bootargs=console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrcethaddr=3C:EF:8C:C6:48:17appauto=1ID=2GPAW7EF49C6021stdin=serialstdout=serialstderr=serialfilesize=48fileaddr=5000000
Environment size: 1346/131068 bytes
partition file version 2
rootfstype squashfs root /dev/mtdblock5
fail to load bootargsParameters.txt
fail to load bootargsParameters.txt file
cmdLine console=ttyS0,115200 mem=118M root=/dev/mtdblock5 rootfstype=squashfs init=/linuxrc
 
Top